Privacy Policy

Unless stated otherwise, the party acting as data controller for the GetUp Service is:

• Legal name: AUTH LIMITED (AUTH LTD)
• Address: Suite A, 82 James Carter Road, Mildenhall, England, IP28 7DE, United Kingdom
• Companies House: 17296846
• Email (DPO / Data Protection): privacy@getup.dev
• General contact: support@getup.dev

Note: for data about the customer company's own employees or customers, the customer company is the data controller; GetUp acts as data processor.

• Active account data: until the account is deleted.
• Invoices and accounting records: 6 years under UK tax law.
• Login logs, security events: 12 months.
• Support correspondence: 24 months.
• Connected apps: access keys are deleted 7 days after they expire or are replaced, and the record of a disconnected app 90 days after it was disconnected. A proposed change nobody decides on closes after 7 days; proposals are deleted 90 days after they were decided, closed or withdrawn. The log of what an app read, proposed and changed stays in the activity log for 12 months.
• After account deletion: personal data deleted within 30 days; legally mandated records kept in encrypted archive.

We rely on the following sub-processors to provide the Service. A GDPR Art. 28 compliant DPA is or will be in place with each.

Transfers to US-based providers rely on the Standard Contractual Clauses (SCC) approved by the European Commission and/or the EU-US Data Privacy Framework.

Apps a business connects. A business can connect an AI assistant such as Claude (Anthropic, PBC) to its GetUp account through the GetUp connector. While the connection lasts, GetUp lets that app read the business's data in GetUp whenever it asks, including personal data of the business's staff and customers held there. Depending on the level the business chooses when connecting, the app can also propose changes, which are made only after someone signed in as the business approves them in GetUp, or make changes directly, which GetUp carries out as soon as the app requests them. Erasing an employee's personal data always requires the business's approval in GetUp. GetUp does this on the business's instruction. The app's provider is not our sub-processor: it receives the data as a recipient chosen by the business and processes it under its own agreement with the business.

For each connection we keep the app's name and address, the level the business chose, when it was connected and last used, and only hashed copies of its access keys. We keep each proposed change with its details (for example, a new employee's name and contact details) and the business's decision. Every read, proposal, change and decision is recorded in the business's activity log. The business can disconnect an app at any time under Integrations; changing the business password disconnects every app. When an app is disconnected, the changes it proposed that are still waiting are withdrawn.

Under GDPR you have the following rights:

• Access (Art. 15): obtain a copy of the data we process about you.
• Rectification (Art. 16): correct inaccurate or incomplete data.
• Erasure (Art. 17): have your data deleted under certain conditions.
• Restriction (Art. 18): limit processing under certain conditions.
• Portability (Art. 20): receive your data in a structured, machine-readable format.
• Objection (Art. 21): object to legitimate-interest processing.
• Withdraw consent: stop consent-based processing.
• Automated decisions (Art. 22): not be subject to solely automated decisions.
• Complaint to UODO: uodo.gov.pl.

To exercise your rights, email privacy@getup.dev. We respond within 30 days (up to 60 for complex requests, with notice).

• All data in transit is encrypted with TLS (HTTPS).
• Data at rest (Supabase, Frankfurt) is encrypted by default.
• Passwords are hashed with bcrypt and additionally encrypted with a server secret.
• Admin login requires 2FA (TOTP).
• Role-based access control; session tokens signed with HMAC-SHA256.
• Apps connected to GetUp (such as Claude) are authorised with OAuth 2.1 and PKCE. Depending on the level the business chose, they can only read, also propose changes that the business approves in GetUp, or also make changes directly; erasing personal data always needs the business's approval in GetUp. Their access keys are stored only as SHA-256 hashes.
• Regular security updates and dependency vulnerability (CVE) scans.
• Access and activity logs are retained.

Per GDPR Art. 33, breaches are reported to UODO within 72 hours of detection. If the breach poses a high risk to users, they are notified directly (Art. 34).

GetUp uses strictly necessary cookies for session management, security, and preferences (e.g. getup_session). These do not legally require explicit consent. Page-view and performance statistics come from Cloudflare Web Analytics, which sets no cookies and does not track individual visitors. You can disable cookies in your browser, but the Service will not function without strictly necessary ones.

The Service is not designed for persons under 16. We do not knowingly collect data from anyone under 16; any such data is deleted promptly upon discovery.

The sub-processors (Supabase, Cloudflare, Anthropic, OpenAI, Upstash, Stripe, Resend, Google) are US-based. Transfers rely on the Standard Contractual Clauses (SCC). The database and the files you upload are kept in the EU, in Frankfurt.

We may update this policy from time to time. Material changes are announced by email and the “Last update” date at the top of this page is revised.

Data protection: privacy@getup.dev
General support: support@getup.dev